1.1 --- a/app/main/_filter/21_auth.lua	Mon Sep 27 10:57:00 2021 +0200
     1.2 +++ b/app/main/_filter/21_auth.lua	Mon Sep 27 10:58:14 2021 +0200
     1.3 @@ -137,14 +137,22 @@
     1.4        error("array type params not implemented")
     1.5      end
     1.6    end
     1.7 -  request.redirect{
     1.8 -    module = 'index', view = 'login', params = {
     1.9 -      redirect_module = module,
    1.10 -      redirect_view = view,
    1.11 -      redirect_id = param.get_id(),
    1.12 -      redirect_params = params
    1.13 +  if config.login and config.login.method == "oauth2" then
    1.14 +    request.redirect{
    1.15 +      module = "oauth2_client",
    1.16 +      view = "redirect",
    1.17 +      params = { provider = config.login.provider }
    1.18      }
    1.19 -  }
    1.20 +  else
    1.21 +    request.redirect{
    1.22 +      module = 'index', view = 'login', params = {
    1.23 +        redirect_module = module,
    1.24 +        redirect_view = view,
    1.25 +        redirect_id = param.get_id(),
    1.26 +        redirect_params = params
    1.27 +      }
    1.28 +    }
    1.29 +  end
    1.30  elseif auth_needed and app.session.member.locked then
    1.31    trace.debug("Member locked.")
    1.32    request.redirect{ module = 'index', view = 'login' }

     2.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     2.2 +++ b/app/main/oauth2_client/callback.lua	Mon Sep 27 10:58:14 2021 +0200
     2.3 @@ -0,0 +1,88 @@
     2.4 +local provider = param.get("provider")
     2.5 +local provider_config = config.oauth2_providers[provider]
     2.6 +if not provider_config then
     2.7 +  return
     2.8 +end
     2.9 +
    2.10 +
    2.11 +local error = param.get("error")
    2.12 +
    2.13 +if error then
    2.14 +  ui.heading{ content = "OAuth error" }
    2.15 +  ui.container{ content = error }
    2.16 +  return
    2.17 +end
    2.18 +
    2.19 +local state = param.get("state")
    2.20 +
    2.21 +if state ~= app.session:additional_secret_for("oauth") then
    2.22 +  ui.heading{ content = "OAuth error" }
    2.23 +  ui.container{ content = "state invalid" }
    2.24 +  return
    2.25 +end
    2.26 +
    2.27 +local code = param.get("code")
    2.28 +
    2.29 +local params = {
    2.30 +  code = code,
    2.31 +  client_id = provider_config.client_id,
    2.32 +  client_secret = provider_config.client_secret,
    2.33 +  redirect_uri = request.get_absolute_baseurl() .. "oauth2_client/callback.html?provider=" .. provider,
    2.34 +  grant_type = "authorization_code"
    2.35 +}
    2.36 +
    2.37 +local params_list = {}
    2.38 +for key, val in pairs(params) do
    2.39 +  table.insert(params_list, encode.url_part(key) .. "=" .. encode.url_part(val))
    2.40 +end
    2.41 +
    2.42 +local r = table.concat(params_list, "&")
    2.43 +
    2.44 +local output, err, status = extos.pfilter(nil, "curl", "-X", "POST", "-d", r, provider_config.token_url)
    2.45 +
    2.46 +local result = json.import(output)
    2.47 +
    2.48 +local url = provider_config.id_url .. "?access_token=" .. encode.url_part(result.access_token)
    2.49 +
    2.50 +local output, err, status = extos.pfilter(nil, "curl", url)
    2.51 +
    2.52 +local id_result = json.import(output)
    2.53 +
    2.54 +local id = id_result[provider_config.id_field]
    2.55 +local email = id_result[provider_config.email_field]
    2.56 +
    2.57 +if id then
    2.58 +  local member = Member:new_selector()
    2.59 +    :add_where{ "authority = ?", "oauth2_" .. provider }
    2.60 +    :add_where{ "authority_uid = ?", id }
    2.61 +    :optional_object_mode()
    2.62 +    :exec()
    2.63 +    
    2.64 +  if not member then
    2.65 +    member = Member:new()
    2.66 +    member.authority = "oauth2_" .. provider
    2.67 +    member.authority_uid = id
    2.68 +    member.notify_email = email
    2.69 +    member.name = "Member " .. id
    2.70 +    member.identification = "Member " .. id
    2.71 +    member.activated = "now"
    2.72 +    member:save()
    2.73 +    for i, unit_id in ipairs(provider_config.unit_ids) do
    2.74 +      local privilege = Privilege:new()
    2.75 +      privilege.member_id = member.id
    2.76 +      privilege.unit_id = unit_id
    2.77 +      privilege.initiative_right = true
    2.78 +      privilege.voting_right = true
    2.79 +      privilege:save()
    2.80 +    end
    2.81 +  end
    2.82 +  member.last_login = "now"
    2.83 +  member.last_activity = "now"
    2.84 +  member.active = true
    2.85 +  member:save()
    2.86 +  app.session.member = member
    2.87 +  app.session:save()
    2.88 +  request.redirect{ external = request.get_absolute_baseurl() }
    2.89 +  
    2.90 +end
    2.91 +

     3.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     3.2 +++ b/app/main/oauth2_client/redirect.lua	Mon Sep 27 10:58:14 2021 +0200
     3.3 @@ -0,0 +1,29 @@
     3.4 +local provider = param.get("provider")
     3.5 +local provider_config = config.oauth2_providers[provider]
     3.6 +if not provider_config then
     3.7 +  return
     3.8 +end
     3.9 +
    3.10 +local params = {
    3.11 +  response_type = "code",
    3.12 +  redirect_uri = request.get_absolute_baseurl() .. "oauth2_client/callback.html?provider=" .. provider,
    3.13 +  client_id = provider_config.client_id,
    3.14 +  --scope = provider_config.scope,
    3.15 +  state = app.session:additional_secret_for("oauth"),
    3.16 +}
    3.17 +
    3.18 +if provider_config.additional_auth_params then
    3.19 +  for key, val in pairs(provider_config.additional_auth_params) do
    3.20 +    params[key] = val
    3.21 +  end
    3.22 +end
    3.23 +
    3.24 +local params_list = {}
    3.25 +for key, val in pairs(params) do
    3.26 +  table.insert(params_list, encode.url_part(key) .. "=" .. encode.url_part(val))
    3.27 +end
    3.28 +
    3.29 +local url = provider_config.auth_url .. "?" .. table.concat(params_list, "&")
    3.30 +
    3.31 +request.redirect{ external = url }
    3.32 +